Enterprise Wi-Fi Recon -rEAPing the benefitsL UK E MCDO NNE LL

(intrepid)

Disclaimer

All views, ideas and opinions shared are my own. Unless they are quotes, pictures, links, or technical looking information, which is most likely copied from search engine results.

Anything I say or express are my own views and not the views, opinions of, or in any way related to the company I work for or its affiliates.

Agenda• About me

• What this talk isn’t about

• What this talk is about

• Good content (hopefully)

• Various stages of enterprise wireless maturity

• Recon

• Harvesting

• Probes

• How/where to apply it

• Recap

About me

• 9+ years as sysadmin in payments and defence type companies

• Pentesting for about a year

• Got a few certs including

• Some SANS certs

• OSWP

About me

• Play hard, work hard

• Surfing

• Mountain biking

• Pentest like I ride…

About me

• Crashing• Riding

About me

• Testing • Crashing

Generic enterprise wireless pentest

• Wireless scanning

• Find SSIDs in range

• Walk around, searching for rogue devices

• Identify Security protocols (WPA/WEP/EAP)

• Crack/Brute force

• FakeAP/Evil Twin etc…

• Everything this talk is NOT about

Enterprise Recon

• What else is there?

• What/how can it be applied?

Various stages of enterprise wireless maturity

Stages of enterprise wireless maturity

• Mature, large company with a good budget, some security knowledge

• Good security consultant

• Small company/low budget

• Growing company

• some good security

• WPA single network

• WPA multiple network

• Open network wireless as only Wi-Fi network

• Cowboys – no idea on wireless security

• Same• WEP

• OPEN/WPA/EAP multiple networks

Open networks

• All size businesses use open

• Small businesses open only

• Large enterprise incorporate open as part of their solution

• Cowboys/Use case

• Open slather/Locked down

• If not air gapped no excuse

WEP networks

• Small businesses

• Zero idea on security

• Zero budget

• No excuse for this in 2016

WPA/2 networks

• Small - Mid sized business

• Growing Business

• Some idea of security

• Low budget

• Low resources

EAP networks

• Large enterprise

• More advanced life forms

• Good security team

• Good wifi security

• Good security consultant/contractor

Applying this information

• Size of the company

• Complexity or size of actual scope compared to agreed scope

• Maturity of security within the company

• Do they apply similar security to the rest of the business?

• If WEP is being used, they probably don’t care about SSLv2

• Expect that if they are using certs for Wi-Fi they probably have good knowledge of certs elsewhere

Recon

Manufacturer

• airodump –manufacturer

• show what kit is being used

Use of multiple SSIDs

• This can also show the maturity of the wireless solution

• eg ‘mobility’ network, ‘corp’ network, ‘guest’ network

Use of multiple SSIDs

• Businesses really don’t know what wireless networks they have

• can use "next in line mac" to identify other SSIDs

• Not in scope != company doesn’t want it included

• DEV networks

Applying this information• Manufacturer

• Identify preferred vendor

• Make assumptions on security decisions• Cisco – Old school “no-one got

fired for buying cisco”

• Aruba – Cutting edge, better security?

• Mixed kit – Legacy? Slow to decommission?

• Unidentified firewall on external? Try the identified Wi-Fi vendor

• Use of multiple SSIDs

• Mobility – Use lootybooty

• DEV networks

• Open access

• Easy password

• Finding more SSIDs than specified in scope

• If Wi-Fi pentest, shows you’re doing your job!

Harvesting

Open Wi-Fi• Internal DNS server

• Sniff DNS lookups, internal hostnames

WPA/2

• Dependant on password list

• Scrape the website for words, add ‘guest’ or ‘123’ and bam, password found.

(not really harvesting, more of a tip)

EAP/PEAP

• crEAP

• Harvest domain and usernames

• EAPeak

Applying this information

• List of internal hostnames and IP addresses

• Useful for internal pentests

• Valid domain and usernames

• Well.. Urgh

• VPN

• Internal pentest

• External webapps

• Anything that uses same auth mechanism

• Scrape websites for Director names and other logins

Probes

Probes

• Even if a client is connected, it will still probe for previously associated Wi-Fi networks

• Airodump-ng

Probes

Company assets are probing for “Maccas free wifi” and every other coffee shop

• Assumption of policies and policy adherence

• Machines are not locked down to specific SSIDs

• Running evil twin of hostapd-wpe is going to be easy

• Shows what the users think of network policies and what is ‘cyber safety’

• More likely to have rogue APs

Probes

• Find rogue access points

• PC1 is connected to ‘easywifi123’

But is also probing for ‘CORP’

We could assume that either there is a 3G device or a rogue access point

Probes

• Airgraph-ng

• Find out about office romances

• PC1 probe: JanesWIFI

Credentials: John director

• PC2 probe: JanesWIFI

Credentials: Jane PA

Applying this information

• An idea of security awareness level of the employees

• What level of response to expect from the rest of the employees for the rest of the engagement/s

• List of probed SSIDs

• Useful for Hostapd-wpe or evil twin attacks

• Rogue access point SSID

• Easy entry into the corp network

Recap

What do we have

• An idea of the security posture of the company

• Possible preferred manufacturer/vendor

• List of internal hostnames and IP addresses

• Valid domain and usernames

• Possible entry point into the network via rogue APs or with credentials

• Proof that the CEO spends time at his personal assistant’s house which will help to blackmail more pentesting work out of the company…

And we haven’t even walked into the building…

Links

• crEAPhttps://github.com/Shellntel/scripts/blob/master/crEAP.py

• Aircrack suitehttp://www.aircrack-ng.org/

• EAPeakhttps://github.com/securestate/eapeak

• Lootybootyhttps://github.com/Torinson/lootbooty

• Hostapd-wpehttps://github.com/OpenSecurityResearch/hostapd-wpe

• Evil twinhttp://www.aircrack-ng.org/doku.php?id=airbase-ng

Questions?